# CVE-2016-10033: Remote code execution in PHPMailer

Source: https://junglewise.ai/threats/cve-2016-10033-phpmailer-command-injection-in-mailsend-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-03-05. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2016-10033 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-03-05

PHPMailer is a widely used code library for sending emails from web applications, including popular platforms like WordPress and Drupal. A critical security flaw allows attackers to remotely execute their own commands on the web server by submitting a specially crafted email address through website forms. This could lead to a full takeover of the server, theft of sensitive customer data, or a complete shutdown of the website.

Technologies: [phpmailer/phpmailer (Packagist)](https://junglewise.ai/threats/technologies/phpmailer-phpmailer), [PHPMailer](https://junglewise.ai/threats/technologies/phpmailer). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2016-10033 exploited in the wild?** Yes. CVE-2016-10033 is known to be exploited in the wild, first recorded on 7 July 2025. Treat it as urgent.

**How severe is CVE-2016-10033?** Critical severity, with a CVSS score of 3.1, published 5 March 2020.

**Which products and versions are affected?** phpmailer/phpmailer (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.2.18.

**Is there a fix for CVE-2016-10033?** Yes. phpmailer/phpmailer (Packagist): upgrade to 5.2.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10033 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10033?** Check whether you run phpmailer/phpmailer (Packagist) or PHPMailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmailer/phpmailer (Packagist): upgrade to 5.2.18 or later

  ```sh
  composer require phpmailer/phpmailer:^5.2.18
  ```


## Technical details

A command injection vulnerability exists in PHPMailer's isMail transport mechanism within the mailSend function. The vulnerability is caused by improper neutralization of argument delimiters (CWE-88) when handling the Sender property, specifically failing to sanitize backslash-double quote sequences. A remote, unauthenticated attacker can exploit this by providing a specially crafted email address that passes extra parameters to the underlying system mail command. Successful exploitation allows for arbitrary code execution in the context of the web server user, while failed attempts may cause a denial-of-service. This issue was patched in version 5.2.18.

## Affected products

- PHPMailer PHPMailer before 5.2.18

## Identifiers

- CVE-2016-10033
- GHSA-5f37-gxvh-23v6

## Timeline

- 2016-12-24: disclosed: Initial public disclosure and exploit release
- 2016-12-24: patched: Fixed in version 5.2.18
- 2025-07-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [PHPMailer Local file inclusion](https://junglewise.ai/threats/cve-2006-5734-phpmailer-local-file-inclusion)
- [PHPMailer Shell command injection](https://junglewise.ai/threats/cve-2007-3215-phpmailer-shell-command-injection)
- [PHPMailer vulnerable to email header injection](https://junglewise.ai/threats/cve-2012-0796-phpmailer-vulnerable-to-email-header-injection)
- [PHPMailer susceptible to arbitrary code execution](https://junglewise.ai/threats/cve-2008-5619-phpmailer-susceptible-to-arbitrary-code-execution)
- [PHPMailer untrusted code may be run from an overridden address validator](https://junglewise.ai/threats/cve-2021-3603-phpmailer-untrusted-code-may-be-run-from-an-overridden-address)